MPMS 5.5-82 “Psosz3e2sa oasusss ui 
FOS 7-03 


Manual of Petroleum 
Measurement Standards 
Chapter 5— Metering 


Section 5—Fidelity and Security of Flow 
Measurement Pulsed-Data 
Transmission Systems 


FIRST EDITION, JUNE 1982 


American Petroleum Institute 
2101 L Street, Northwest 


Washington, D.C. 20037 ip 


Copyright por American Petroleum Institute 
Thu Dec 14 22:44:35 2000 


Mens 5-S-82 | o732290 0055000 Sif 


Manual of Petroleum 
Measurement Standards 
Chapter 5— Metering 


Section 5—Fidelity and Security of Flow 
Measurement Pulsed-Data 
Transmission Systems 


Measurement Coordination Department 


FIRST EDITION, JUNE 1982 


American 
Petroleum 
Institute 


p 


Copyright por American Petroleum Institute 
Thu Dec 14 22:44:56 2000 


MPNS 5-5-2 | | o732290 0055001 q 


Nothing contained in any API publication is to be construed as granting any right, by 
implication or otherwise, for the manufacture, sale, or use in connection with any method, 
apparatus, or product covered by letters patent, nor as insuring anyone against Itability for 
infringement of letters patent. 

API publications may be used by anyone desiring to do so. Every effort has been made by 
the Institute to assure the accuracy and reliability of the data contained in them; however, the 
Institute makes no representation, warranty, or guarantee in connection with API publications 
and hereby expressly disclaims any liability orresponsibility for loss or damage resulting from 
their use; for any violation of any federal, state, or municipal regulation with which an APT 
publication may conflict; or for the infringement of any patent resulting from the use of an API 
publication. 


Copyright @ 1982 American Petroleum Institute 


Copyright por American Petroleum Institute 
Thu Dec 14 22:44:56 2000 


mems 5.5-82 | | a7a2290 oossooe : 


FOREWORD 


This publication is intended as a guide to the selection, operation, and maintenance of 
pulsed-data, cabled transmission systems for fluid metering systems to provide the desired 
level of fidelity and security of transmitted data. 

A comprehensive API Manual of Petroleum Measurement Standards is currently being 
prepared. The manual will include all subject matter now found in API measurement 
publications—excluding evaporation loss measurement—as well as new material. 

Suggested revisions are invited and should be submitted to the director of the Measurement 
Coordination Department, American Petroleum Institute, 2101 L Street, N.W., Washington, 
D.C. 20037. 
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Chapter 5—Metering 


SECTION 5—FIDELITY AND SECURITY OF FLOW MEASUREMENT 
PULSED-DATA TRANSMISSION SYSTEMS 


5.5.0 Introduction 


The purpose of this publication is to serve as a guide for the 
selection, operation, and maintenance of various types of 
pulsed-data, cabled transmission systems for fluid metering 
systems to provide the desired level of fidelity and security of 
transmitted data. This publication does not endorse or advo- 
cate the preferential use of any specific type of equipment or 
systems, nor is it intended to restrict future development of 
such equipment. 

Acknowledgement is extended to the Institute of Pe- 
troleum in the United Kingdom for their contribution to this 
section of the Manual of Petroleum Measurement Standards. 


5.5.1 Scope 


The recommendations set forth in this publication are 
concerned only with the fidelity and security of pulsed-data, 
cabled transmission systems between a flow meter or flow 
meter transducer and a remote totalizer. 


5.5.2 Field of Application 


In order to achieve different levels of security that can be 
applied to transmission systems, criteria and recommenda- 
tions for the design, installation, use, and maintenance of the 
relevant equipment are described in this publication. The 
levels of security are designated E to A from the lowest to the 
highest order of security, respectively. Chapter 5 Section 5 
does not define which levels of security are to be used for a 
particular system application. 


5.5.3 Definitions 


See MPMS Chapter 1, ‘‘Vocabulary,’’ for additional 
definitions. 

Fidelity is defined as the exactitude with which the primary 
indication reproduces the inherent precision of the measure- 
ment. 

Methods of comparison, as used in Levels A through D, is 
the determination of the fidelity of primary indication by use 
of a redundant, alternate, or secondary source to verify the 
desired level of security. 

Noise consists of unwanted signals that may affect fidelity 
and which occur for periods exceeding 0.2 seconds. 

A scaler is an electronic device that operates a recorder 
after a specified number of impulses, appearing too rapidly 
for individual recording. 

‘Transients are disturbances having a duration of 0.2 sec- 
onds or less. 
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5.5.4 Levels of Security 


Five levels of security protection are identified and des- 
ignated, of which Level B represents the minimum accept- 
able level. ‘Typical examples of these five levels are shown 
diagrammatically in Figures 1 through 5. A metering system 
may comprise sections having the same or different levels of 
security protection, where the outputs are used for different 
purposes. Figures 1 through 5 show typical functional ar- 
rangements of modules required to achieve the specified 
levels of security. These function modules may be housed 
separately or in combination. 

In the examples, emphasis has been placed on the trans- 
mission system because this is considered the most vulner- 
able area of the whole. Fidelity and security for scaler and 
totalizer are not illustrated and are considered to be accept- 
able to Level E for the majority of applications. It may, 
however, be considered necessary in some circumstances to 
duplicate the sealer and/or totalizer section. 


5.5.4.1 LEVELE 


Error reduction at Level E is achieved solely by correctly 
installed apparatus of good quality. This is a straightforward 
totalizer system. Figure | illustcates a simple system with no 
built-in provisions for error monitoring. Only good quality 
components and subunits, correctly installed, will lead to 
confidence in the security of the system. The use of a pre- 
amplifier transmitter to drive the transmission line is consid- 
ered beneficial for the majority of applications, as is the 
provision of signal conditioning. The system, though simple, 
does not differ in hardware quality from more secure systems 
that use the same clements. 


5.5.4.2 LEVEL D 


A Level D system consists of manual error monitoring at 
specified intervals by methods of comparison. This level of 
security is intended to give protection against functional 
etrors and failures and is a method of verification by manual 
acliou, The readout can be visually cheeked against an inde 
pendent totalizing system. Figure 2 illustrates a simple sys- 
tem with means of making a periodic manual assessment of 
security. The secondary readout may be permanent or tem- 
porary, local or remote. Manual comparison made during a 
periodic check will monitor the integrity of the transmission 
and totalizer elements. It may be less convenient than provi- 
sions of Level C, as the system may have to be stopped for 
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Figure 1—Typical Functional Arrangement for a Level E Pulse Security System 
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Figure 2—Typical Functional Arrangement for a Level D Pulse Security System 
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readings to be taken. Overall security is mainly inferred from 
the performance during the error monitoring period. 


5.5.4.3 LEVEL CG 


A Level C system consists of automatic error monitoring 
and error indication at specified intervals by methods of 
comparison. This level of security is intended to give protec- 
tion against functional errors and failures and may be 
achieved by design methods. The time intervals for error 
monitoring may be subject to revision in the light of experi- 
ence gained. Figure 3 illustrates a dual transmission system 
with a dual pulse comparator of simple design. If the pulses 
delivered become numerically out of step, warning will be 
given by the comparator (differential counter). Level C se- 
curily will be defeated by other disturbances dealt with by 
higher level security systems, for example, simultaneous 
interference superimposed on both channels will not be de- 
tected because a numerical difference between channels is 
not caused. [tis intended that this form of error monitoring be 
earried out periodically; the monitoring equipment may thus 
be shared with other metering systems. Level C security is 
inferred from the results obtained during the monitoring 
period. 


5.5.4.4 LEVEL B 


Level B consists of continuous monitoring, error indica- 
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tion, and alarm signaling by methods of comparison. This 
level of security is intended to give warning of transients and 
other spurious influences, in addition to functional errors and 
failures. Figure 4 illustrates a dual transmiasion syatem with a 
dual pulse comparator in which the pulse trains are continu- 
ously monitored for number, frequency, phase, and sequence 
and any ixregularity is indicated. Simultaneous interfering 
pulses must be detected and indicated. Alarm is given if 
pulses are lost or gained on either channel. 


5.5.4.5 LEVELA 


Level A consists of continous verification and correction 
by methods of comparison. ‘I'his level of security is intended 
to give protection against transients and other spurious influ- 
ences, in addition to functional errors and failures. Figure 5 
illustrates a dual transmission system protected against both 
dynamic faults arising from monitoring the duplicated 
pulses and by static testing the electrical integrity of the 
transmission circuits. The system should still operate as a 
Level E system if one of the transmission channels fails. An 
incidental advantage of Level A is its ability to detect some 
mechanical faults in the transducer. Simultancous pulscs 
caused by symmetrical interference are automatically re- 
jected and do not influence the system. Alarm will be given in 
all circumstances when impaired pulses are received by the 
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Figure 3—Typical Functional Arrangement for a Level C Puise Security System 
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Figure 4—Typical Functional Arrangement for a Level B Pulse Security System 
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SECTION 5—FIDELITY AND SECURITY 5 


comparator. It may be desirable to provide redundancy in one 
or all of the elements shown. 


5.5.5 System Design Considerations 
5.5.5.1 GENERAL DESIGN CRITERIA 


The most important consideration is to prevent the occur- 
rence of spurious pulses rather than rely upon the provision of 
verification circuitry to provide protection against the results 
of false measurement. The design approach shall, therefore, 
take into account the noise environment. Poorly designed 
units and inadequate regard for noise pick-up can seriously 
influence the performance of the equipment. Low-level 
high-impedance signals become attenuated by line loses, and 
the overall signal-to-noise ratio can further be impaired by 
the greater probability of noise in longer lines. A secure and 
reliable pulsed-data transmission system will be achieved 
most readily by concentrating on the elimination of error 
sensitive elements. Addition of dual circuits or other 
techniques aimed at increasing security will guard against 
influences that are beyond the control of the designer. 

As a precaution, suppliers of signal processing equipment 
should be advised of radio frequencies used in close prox- 
imity so radio frequency interference immunity can be in- 
vestigated. 


5.5.5.2 TOTALIZERS 
§,5.5.2.1 Primary Totalizer 


It is basic to security requirements that the value of the 
totalizer count cannot be impaired during delivery. The use 
of a nonresettable counter is mandatory for revenue ac- 
counting systems and is recommended for all other primary 
systems. 


5.5.5.2.2 Secondary Indication 


Where it is acceptable to the parties concerned in a trans- 
action, ancillary devices need not have as high a degree of 
security protection as the primary indication. However, such 
devices should be given basic approval as part of an overall 
approval and should be compatible with it, Representative 
secondary indicators include a counter directly driven by a 
flow meter, an electromechanical counter, or an electronic 
counter equipped with a standby battery. 


5.5.5.3 TYPICAL CAUSES OF ERROR 


Typical causes of error which should be taken into con- 
sideration are as follows: 


1. Electromagnetic interference. 

2. Transients. 

3. Power supply variations and/or interruption. 
4, Inadequate signal level as a result of line loss. 
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5, Common-mode noise induced in cabling. 

6, Series-mode noise induced in cabling. 

7. Noise introduced from ground loop problems. 

&, Excossive gain and frequency response of the system 
elements. 

9. Spurious signals induced from other meters sharing the 
sare multicore cable. 

10. Short circuit or open circuit of conductor pair or short 
circuit of either conductor to ground or shield. 

11. Bad connections, temperature variations and extremes, 
yibration shock, and adverse environmental conditions. 


5.5.5.4 SIGNAL PRE-AMPLIFIERS 


A signal pre-amplifier should be introduced into the 
transmission system at the transducer, if transmission dis- 
tance or manufacturces’ requirements so dictate. 


5.5.5.5 STANDBY POWER SUPPLY 


Where a power interruption could result in a significant 
error in measurement, provision for an uninterruptible power 
supply should be considered, 


5.5.5.6 TEST REQUIREMENTS 


Careful consideration should be given to the form of tests 
to be applied to the electronic system for fidelity and secu- 
rity purposes. The tests should take into account the major 
environmental hazards that experience shows are likely to be 
encountered on site. 


5.5.5.7 GENERAL PRECAUTIONS 


The gain and frequency response of the system elements 
should be restricted to that required by the application. Sen- 
siivily controls on pre-amplifiers, scalers, and others shall 
not be capable of unauthorized adjustment. The totalized 
pulse counts existing at the time of any power failure shall be 
retained. Cable pairs and the instrument input circuit shall be. 
protected from excessive transient voltages or currents as 
well as electrical storms. 


5.5.6 Installation 
5.5.6.1 SIGNAL AMPLITUDE 


The foliuwing points shall be observed so that the signal 
amplitude from the transducer to the receiver can be main- 
tained at a high level. The installation recommendations 
specified by the manufacturers shall be carefully followed, 
while complying fully with statutory requirements and/or 
safety codes. The length of transmission lines from the 
meter to the readout equipment shall be held to a minimum. 
Proper impedance matching shall be ensured. The appropri- 
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ate technically compatible signal transmission cables shall 
be used. ‘The supply voltages to pre-amplifiers and constant 
amplitude pulse generating systems shall be checked to 
ensure that they are of proper magnitude and do not exceed 
noise or ripple maximums as specified by the equipment 
manufacturer. 


5.5.6.2 SIGNAL-TO-NOISE RATIO 


The following points should be observed so that the 
signal-to-noise ratio can be optimized. Only shielded trans- 
mission cable of the proper material, size, and number of 
conductors shall be used. 

Individual twisted shielded pairs afford the maximum 
protection against noise. Helical lay cables are accept- 
able for many installations, Parallel lay cables should be 
avoided. The shield of a transmission cable should be 
grounded at one point only, to prevent formation of 
ground loops. 

A continuous run of transmission cables should be used 
whenever possible. Where joints are unavoidable, continuity 
of the shield shall be assured. Joints should be encapsulated 
to maintain the electrical specification and security of the 
cable. 

When multireadout devices are used and wired in paral- 
lel, shielded cables should be used for connecting wiring. 

The data transmission lines should not share a conduit with 
anything other than shielded cables or cables from direct 
current temperature sensors. If the maximum electrical 
power carried by any one transmission cable is ten or more 
times greater than the minimum power carried by any 
flowmeter signal data transmission cable, separate conduits 
should be provided. In the event that separate conduits are not 
feasible, additional cable shielding should be incorporated. 
and circuits tested to verify necessary fidelity of signals. Data 
transmission cables should not be nin in parallel with power 
cables. When this is not possible the cables should be 
sufficiently spaced to prevent interference or be adequately 
shielded. 

If itis necessary for transmission cables and power cables 
fo cross, this should be at right angles whenever possible. 
When transmission cables are run in ducts or inside control 
cabinets, every attempt should he made to keep the shielded 
cable bundle intact and separate from other conductors. All 
Spare transmission cable and conductors that are run in a 
conduit with an active transmission line should have the 
shield and conductors grounded at the same singfe point as 
the active line. 

The grouping of cables to intrinsically safe devices with 
other current-carrying cables requires special consideration 
in hazardous areas, and governing regulations must be fol- 
lowed. Typical references are NFPA‘ 493, Insirinsically 
Safe Apparatus in Division 1 Hazardous Locations, and ISA? 
RP 12.6, fnstallation of Instrinsically Safe Instrument Sys- 
tems in Class I Hazardous Locations. 
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5.5.6.3 COMMISSIONING 
5.5.6.3.1 General 


Before commissioning an installation, the commissioning 
engineer shall ensure: 


1. Correct mechanical installation of the equipment. 

2. A satisfactory electrical installation, with particular at- 
tention to weatherproofing of the electrical devices, espe- 
cially the field junction boxes. 

3. Satisfactory wiring, in compliance with applicable stan- 
dards and clectrical safety codes. 


5.5.6.3.2 Testing 


The commissioning of different types of systems will 
demand different procedures, which shall be clearly de- 
fined by the manufacturers. Many manufacturers are able to 
provide relatively simple equipment for testing individual 
parts of a system after installation, and the initial testing and 
calibration of the equipment can often and conveniently be 
carried out before an attempt is made to check the whole 
system. All necessary electrical test apparatus, including an 
oscilloscope and pulse generator, should be provided for 
those personnel responsible for the inspection and mainte- 
nance of the system. The pulse generator used should be 
capable of emulating the pulse form of the particular type of 
transducer being substituted. Such equipment must be of a 
type which is electrically safe for the environment in which 
it is to be used. 

A typical fest method which may be used is to inject a train 
of test pulses into a transmission system at the transmitter 
connections. This test signal should have a strength of not 
more than 50 percent at the normal transmitter signal. The 
test signal shall be monitored by the installed receiving ap- 
paratus, and the signal received shall conform with the test 
signal to within two pulses in one hundred thousand. 

The test should be performed at two conditions that repre- 
sent the maximum and minimum flows between which the 
meter normally operates, except during startup and shut- 
down. 


5.5.7 Inspection and Maintenance 


5.5.7.1 NEED FOR INSPECTION AND 
MAINTENANCE 


Itis essential that regular inspection and maintenance of all 
apparatus, systems, and installations (including cable con- 
duit and the like) is carried out with competent personnel 
according to a schedule that has been agreed upon after 


'National Pie Protection Association, Balterymarea Park, Quincy, Mas- 
sachusetts 02269, 


Instrument Sociely of America, 67 Alexander Drive, Box 12277, Re- 
search Triangle Park, North Carolina 27709. 
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SECTION 5—FIDELITY AND SECURITY 7 


consultation between the manufacturers, their agents, and the 
users. It should be noted that an apparently correct functional 
operation of a system does not necessarily ensure compliance 
with the selected Jevel or levels of security. 


5.5.7.2 GUIDELINES 
5.5.7.2.1 General 


All normal precautions relating to safety must be taken into 
account, especially those pertaining to work in hazardous 
atmospheres. Although production or other operational re- 
quirements should be considered, these should not result in 
the postponement of essential inspection, maintenance, or 
repairs. Following any repairs, adjustments, or modifica- 
tions, those parts of the installation that have been disturbed 
should be checked for compliance with the system specifica- 
tion. The pulse integrity test described in 5.5.6.3.2 should be 
performed at intervals specified by the engineer. 


§.5.7.2.2. Ground Continuity 


Unless special ground fault protection is employed, the 
ground path impedance of each circuit should be low enough 
to permit the passage of a current at least three times the 
current rating of the circuit fuse or protective device. 

All grounding connections (including those of any 
supplementary grounding conductors) shall be checked to 
ensure that they arc clean and tight, and the ground path 
impedance associated with each item of apparatus shall be 
measured at intervals determined by the engineer responsible 
for the system. Ground path impedance measurements shail 
be made as follows, depending upon the area classification 
and the results of any necessary certification testing by the 
responsible authority. If there is no likelihood of a flammable 
atmosphere being present, impedance measurements shall be 
made at a current of not less than 15 amperes. 

‘When there is any risk of a flammable atmosphere being 
present, impedance measurements shail be made with an 
intrinsically safe continuity tester. It must be appreciated, 
however, that in the case of these instruments, because of the 
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very low current level involved, no indication can be given at 
the current carrying capacity of the circuit under test. Fur- 
thermore, the tests can be adversely affected by stray current. 
Grounding continuity does not guarantee the effectivenese of 


cable shielding. 


5.5.7.2.3 Protective Devices 


Atintervals determined by the engineer responsible for the 
system, all protective devices (such as alarms, trips, and 
standby equipment) shall be examined and, if considered 
necessary, tested to ensure that equipment is operating at 
design settings. 


5.5.7.2.4 Outside Interference 


Checks should be made to ensure that no additional extra 
apparatus has been installed in the vicinity of the system. If 
other apparatus has been installed since the last inspection, 
then the system shall be tested to ensure that no signal is 
induced into the system by the adjacent apparatus. 

The transmission system shall be tested for continuity, 
insulation, and signal impedance. 


5.5.7.2.5 Records 


A system shall be established to record the results of 
inspections and tests for all apparatus, systems, and installa- 
tions and the details of corrective actions taken. The records 
shall include details of all modifications, additions, or 
deletions, none of which are to be made without prior 
permission. The signal strength produced during normal 
operation should be measured at the receiver and compared 
with the values obtained when the system was installed or 
most recently modified. 


5.5.7.2.6 Spares 


Vital spares according to the manufacturers’ recommen- 
dations should be readily available for the correct mainte- 
nance of equipment. 
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